CORS preflight for the sandbox approval-token endpoint
Returns 204 with write-side CORS — Access-Control-Allow-Methods: POST, OPTIONS; Access-Control-Allow-Headers: Authorization, Content-Type, Idempotency-Key, X-Correlation-ID; Access-Control-Allow-Credentials: false (Bearer tokens flow cross-origin with credentials=false).: Authorization is on Allow-Headers because the sandbox is auth-gated. Max-Age 86400.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/sandbox/auth/approval-token
- Auth: none required
Response
CORS preflight response for the write-side endpoints (/api/v1/sandbox/auth/approval-token, /api/v1/sandbox/actions/plan, /api/v1/sandbox/actions/execute). Differs from SandboxOptionsPreflight in four deliberate ways: (1) Allow-Methods is POST, OPTIONS not GET, OPTIONS; (2) Allow-Headers list includes Authorization (sandbox is auth-gated; browser preflights must allow the header or the cross-origin POST fails CORS before the handler runs); (3) Access-Control-Allow-Credentials: false is set explicitly (Bearer tokens flow cross-origin with credentials=false; only cookies require credentials=true); (4) Max-Age is 86400 (24h, not 1h) — preflight stable across the entire deploy.
Changes
No recorded changes to this operation across all 1 revision of this API.